Add cmdio.RenderFiltered to strip fields from rendered output

[Divyansh-db]

Summary

Adds new cmdio.RenderFiltered and cmdio.RenderIteratorFiltered entry points that mirror Render / RenderIterator but accept a []string of dotted JSON paths to strip from the value before it is marshaled. The path list is consulted only by the JSON render path; text/template rendering is unchanged.

// before
return cmdio.Render(ctx, response)

// after, when the response type has input-only fields
return cmdio.RenderFiltered(ctx, response, []string{"initial_workspace_id"})

Path syntax is dotted (a.b.c); arrays are traversed transparently, so the same path expression works for singleton and list responses without an items[] marker.

Motivation

The Databricks SDK uses a single Go struct per resource for both request and response (transport-layer pattern). Some fields are REQUIRED on the request side, so the SDK marshals them unconditionally, while also being INPUT_ONLY per the OpenAPI spec — they're never populated on responses. Generated CLI commands hand the SDK response struct directly to json.MarshalIndent, so those fields leak into user-visible output as empty strings even when the server omits them.

Existing in-repo precedents for honoring x-databricks-field-behaviors:

• bundle/direct/tools/generate_resources.py reads INPUT_ONLY / OUTPUT_ONLY from the OpenAPI spec and propagates them into the DABs direct engine's ignore_remote_changes config.
• bundle/internal/schema/main.go's removeOutputOnlyFields strips OUTPUT_ONLY from the bundle JSON schema.

RenderFiltered is the equivalent seam on the CLI response render path. This PR adds only the entry points; the genkit template change that starts calling them will land separately, followed by the generated-code regeneration in cmd/account/** and cmd/workspace/**.

Design notes

• Render is unchanged in behavior (now a thin wrapper around RenderFiltered(_, _, nil)). Existing callers don't need to change.
• Internal helper applyInputOnlyMask in libs/cmdio/filter.go round-trips the value through json.Marshal into a generic map[string]any tree, removes the listed leaf keys, and returns the masked value for the caller to marshal in its preferred format. Operating on the generic tree (rather than on raw bytes) lets defaultRenderer.renderJson and iteratorRenderer.renderJson reuse the same masking logic despite using different MarshalIndent prefixes.
• Filtering happens before colorizeJSON, so the colorized output stays consistent.

Test plan

• go test ./libs/cmdio/... — pass (new and existing tests)
• gofmt -l clean on changed files; go vet ./libs/cmdio/... clean
• ./task fmt-q / ./task lint-q — 0 issues
• Unit tests cover: empty paths no-op, flat field strip, nested field strip, slice element strip, multiple paths, missing-path no-op, and an integration test confirming RenderFiltered matches plain Render when no paths are supplied.

[github-actions]

Waiting for approval

Based on git history, these people are best suited to review:

• @pietern -- recent work in libs/cmdio/

Eligible reviewers: @chrisst, @hectorcast-db, @mihaimitrea-db, @parthban-db, @rauchy, @renaudhartert-db, @simonfaltum, @tanmay-db, @tejaskochar-db

_{Suggestions based on git history. See OWNERS for ownership rules.}

[eng-dev-ecosystem-bot]

Commit: e3d5421

Run: 27016619624